WalletPrint

• Outcome: Review
• Latest audit: Aug 29, 2026 · 11:43 AM UTC
• Version: 0.1.0

Overview

The skill is a coherent hosted wallet-risk scoring SDK, but users should treat submitted wallet and transaction details as sensitive data shared with WalletPrint.

Before installing for production, confirm that your users and compliance process allow proposed wallet transactions to be sent to WalletPrint, decide whether production persistence and Alchemy history seeding are acceptable, configure webhooks only to trusted HTTPS endpoints, avoid sensitive free-form feedback notes, and add your own approval gate before signing high-risk transactions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (18)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to send wallet addresses, chain information, recipient addresses, transaction amounts, and related metadata to a third-party WalletPrint service, but it does not clearly disclose that external transmission or its privacy implications. In an agent context, this can cause operators or users to unknowingly exfiltrate sensitive financial behavior and transaction intent data to an outside service before signing.

Missing User Warnings

Low

• Confidence: 94% confidence
• Finding: The feedback example uploads post-execution labels and free-form notes to an external service without warning that this information leaves the local environment. Notes may contain sensitive operational details, internal investigation results, or user-identifying context, creating avoidable privacy and confidentiality risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation explicitly states that optional transaction metadata is stored and later describes audit export of screened transactions and human feedback, but it does not clearly warn users about data retention, access scope, or privacy implications at the point of collection. In a wallet-screening context, transaction details, wallet addresses, and analyst notes can be sensitive operational data, so omission of a clear data-handling notice can lead integrators to transmit regulated or confidential information without informed controls.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The webhook section instructs users to configure an external URL for flagged transaction delivery, but it does not prominently warn that transaction-related details will be transmitted off-platform to a third-party endpoint. This creates a real risk of unintended disclosure if integrators point the webhook at insecure, shared, or improperly governed destinations, especially since flagged transactions may contain sensitive wallet, scoring, and behavioral information.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide walks users directly into calling `client.score()` with wallet addresses, recipient addresses, asset details, value, and optional context without an upfront, prominent disclosure that this data is sent to a third-party service and persisted in production. In a security/privacy-sensitive wallet or agent environment, this can cause operators to unknowingly exfiltrate transaction metadata off-platform, creating compliance, privacy, and trust risks.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The history seeding section says WalletPrint may pull recent on-chain history via Alchemy, but it is framed as a product behavior note rather than a clear warning that production scoring can trigger third-party data retrieval and sharing. Users may enable production scoring without realizing that submitting a wallet address can cause additional enrichment by another external provider, which materially affects privacy, vendor disclosure, and regulatory posture.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README explicitly says the example will 'immediately submit' a `confirmed_benign` label, which modifies external system state, but it does not warn the user that running the example performs a real write action. This can cause accidental feedback submission, data integrity issues, and pollution of downstream scoring or training systems if users test the example against real transactions or production credentials.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The middleware sends derived transaction details and wallet metadata to an external scoring client before submission, but this file provides no user-facing notice, consent flow, or privacy control. Even if intended for fraud screening, this can leak sensitive behavioral and financial metadata such as wallet address, counterparties, asset, transaction type, context, and estimated value to a third party.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"start": "node index.mjs"
  },
  "dependencies": {
    "@walletprint/sdk": "^0.1.0"
  }
}

• Confidence: 87% confidence
• Finding: The dependency uses a caret version range, which allows newer compatible releases to be installed without explicit review. If the upstream package is compromised or introduces a breaking security issue in a later allowed version, builds may pull that version and expose the project to supply-chain risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"start": "node index.mjs"
  },
  "dependencies": {
    "@walletprint/sdk": "^0.1.0"
  }
}

• Confidence: 90% confidence
• Finding: The dependency is specified with a caret range (^0.1.0), which allows installation of newer compatible versions rather than a single audited release. This increases supply-chain risk because a compromised or breaking upstream publish could be pulled in without explicit review, though the impact here is limited by the file being an example package manifest rather than privileged runtime code.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"start": "node index.mjs"
  },
  "dependencies": {
    "@walletprint/sdk": "^0.1.0"
  }
}

• Confidence: 93% confidence
• Finding: The dependency uses a caret range (^0.1.0), which allows automatic installation of newer compatible versions within the 0.x range. Because semver compatibility is less stable for 0.x releases, this increases supply-chain risk: builds may pull unexpected code changes or a compromised upstream release without an explicit review. In an example tool that may be copied into real projects, this practice is still unsafe even if the immediate file is only a demo.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"start": "node index.mjs"
  },
  "dependencies": {
    "@walletprint/sdk": "^0.1.0"
  }
}

• Confidence: 92% confidence
• Finding: The dependency uses a caret range (^0.1.0), which allows installation of newer versions within the 0.x minor compatibility window. This can lead to non-reproducible installs and inadvertent uptake of a compromised or breaking upstream release, creating supply-chain risk even in an example project.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"zod": "^3.25.67"
  },
  "peerDependencies": {
    "@langchain/core": "^0.3.0",
    "@solana/web3.js": "^1.98.0"
  },
  "peerDependenciesMeta": {

• Confidence: 98% confidence
• Finding: The peer dependency range ^0.3.0 for @langchain/core includes versions affected by CVE-2025-68665, a serialization injection issue that can enable secret extraction. Because this package is an SDK intended for AI-agent and wallet use, allowing consumers to satisfy the peer dependency with a vulnerable LangChain release increases the chance of insecure deployments handling sensitive keys or prompts.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

}
  },
  "devDependencies": {
    "@langchain/core": "^0.3.62",
    "@solana/web3.js": "^1.98.2",
    "@types/node": "^22.15.32",
    "typescript": "^5.8.3",

• Confidence: 99% confidence
• Finding: The development dependency @langchain/core at ^0.3.62 is flagged by the linked advisory and may expose maintainers or test/build workflows to the LangChain serialization injection issue. Even though it is a devDependency, compromised development tooling can leak secrets from local environments, CI, or test fixtures used to build an SDK for wallet and agent contexts.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"@types/node": "^22.15.32",
    "typescript": "^5.8.3",
    "uuid": "11.1.1",
    "vitest": "^3.2.4"
  },
  "overrides": {
    "esbuild": "^0.28.1",

• Confidence: 99% confidence
• Finding: Vitest 3.2.4 is identified as affected by CVE-2026-47429, where the Vitest UI server can allow arbitrary file read and code execution. Although it is a devDependency, exploitation in a developer workstation or CI environment could expose source code, environment secrets, signing material, or enable takeover of the build pipeline.

Known Vulnerable Dependency: @langchain/core==0.3.0 — 1 advisory(ies): CVE-2025-68665 (LangChain serialization injection vulnerability enables secret extraction)

High

• Category: Supply Chain
• Confidence: 99% confidence
• Finding: The package declares @langchain/core in a vulnerable version range associated with CVE-2025-68665, a serialization injection flaw that can lead to secret extraction. In an SDK targeting AI agents and crypto wallets, secrets and transaction context are especially sensitive, so using or permitting vulnerable LangChain versions materially raises risk.

Known Vulnerable Dependency: @langchain/core==0.3.62 — 1 advisory(ies): CVE-2025-68665 (LangChain serialization injection vulnerability enables secret extraction)

High

• Category: Supply Chain
• Confidence: 99% confidence
• Finding: The devDependency on @langchain/core 0.3.62 is directly flagged as vulnerable to CVE-2025-68665. Even in development, serialization injection can compromise local or CI secrets, and this project's wallet/agent context makes any secret exposure more serious than in a generic library.

Known Vulnerable Dependency: vitest==3.2.4 — 1 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed)

Critical

• Category: Supply Chain
• Confidence: 99% confidence
• Finding: Vitest 3.2.4 is flagged with a critical advisory for arbitrary file read and execution when the Vitest UI server is listening. That can lead to full compromise of developer or CI environments, theft of repository and environment secrets, and potentially malicious modification of an SDK used in wallet-related ecosystems.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: docs/getting-started.md:16

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: examples/README.md:9

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: README.md:288

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:29